Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by providing ciphertext with a length that is too short to be valid. Per: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-004.txt
"Only releases krb5-1.3 and later are vulnerable, as
earlier releases did not contain the functionality implemented by the
vulnerable code.
This is an implementation vulnerability in MIT krb5, and is not a
vulnerability in the Kerberos protocol." Per: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-004.txt
FIXES
* The upcoming krb5-1.7.1 and krb5-1.6.4 releases will contain a fix
for this vulnerability.
* For the krb5-1.7 release, apply the patch available at:
http://web.mit.edu/kerberos/advisories/2009-004-patch_1.7.txt
A PGP-signed patch is available at
http://web.mit.edu/kerberos/advisories/2009-004-patch_1.7.txt.asc
* For the krb5-1.6 releases, apply the patch available at:
http://web.mit.edu/kerberos/advisories/2009-004-patch_1.6.3.txt
A PGP-signed patch is available at
http://web.mit.edu/kerberos/advisories/2009-004-patch_1.6.3.txt.asc
* The krb5-1.6.3 patch might apply successfully to older releases.
Publication date: Thu, 14 Jan 2010 01:30:00 +0000